Skip to content

Restrict New-Object in NoLanguage mode under lock down #14139 #14140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rjmholt merged 15 commits into from
Dec 8, 2020
Merged

Restrict New-Object in NoLanguage mode under lock down #14139 #14140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
b86ba5b
Potential defense in depth fix
Nov 19, 2020
9222840
Indentation fix
Nov 19, 2020
84cf633
SystemPolicy error fixed
Nov 19, 2020
664e647
Indentation
Nov 19, 2020
497164d
restricted language check performed
Nov 24, 2020
48c887a
Indentation
Dec 2, 2020
1da8610
Indentation
Dec 2, 2020
4986598
Code reorg
Dec 3, 2020
bc76b39
code reorg
Dec 3, 2020
46d8da9
Indentation
Dec 3, 2020
27134a0
indent
Dec 3, 2020
d04617d
Revert "indent"
Dec 3, 2020
716b7b2
condition changed
Dec 3, 2020
707b703
COmpilation corrected
Dec 3, 2020
a8b23b2
lockdown policy error
Dec 4, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions src/Microsoft.PowerShell.Commands.Utility/commands/utility/New-Object.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,7 @@
using System.Management.Automation;
using System.Management.Automation.Internal;
using System.Management.Automation.Language;
#if !UNIX
using System.Management.Automation.Security;
#endif
using System.Reflection;
using System.Runtime.InteropServices;
#if !UNIX
Expand Down Expand Up @@ -199,6 +197,25 @@ protected override void BeginProcessing()
}
}

switch (Context.LanguageMode)
{
case PSLanguageMode.NoLanguage:
case PSLanguageMode.RestrictedLanguage:
if (SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce
&& !CoreTypes.Contains(type))
{
ThrowTerminatingError(
new ErrorRecord(
new PSNotSupportedException(
string.Format(NewObjectStrings.CannotCreateTypeLanguageMode, Context.LanguageMode.ToString())),
nameof(NewObjectStrings.CannotCreateTypeLanguageMode),
ErrorCategory.PermissionDenied,
targetObject: null));
}

break;
}

// WinRT does not support creating instances of attribute & delegate WinRT types.
if (WinRTHelper.IsWinRTType(type) && ((typeof(System.Attribute)).IsAssignableFrom(type) || (typeof(System.Delegate)).IsAssignableFrom(type)))
{
Expand Down
3 changes: 3 additions & 0 deletions src/Microsoft.PowerShell.Commands.Utility/resources/NewObjectStrings.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,9 @@
<data name="CannotCreateTypeConstrainedLanguage" xml:space="preserve">
<value>Cannot create type. Only core types are supported in this language mode.</value>
</data>
<data name="CannotCreateTypeLanguageMode" xml:space="preserve">
<value>Cannot create type. Only core types are supported in {0} language mode on a policy locked down machine.</value>
</data>
<data name="ApartmentNotSupported" xml:space="preserve">
<value>{0} Please note that Single-Threaded Apartment is not supported in PowerShell.</value>
</data>
Expand Down